I received a false alarm on a Windows/system32/user32.dll several times. I closed the computer and went to a tech to learn that there was no worm or virus. It cost me $90 to learn that Avast was giving a false alarm. How can I know when a false alarm exists? When I tried to spell check this note I got an alarm for a virus. The dll was highlighted and Avst gave an alarm.
was it Win32:SysPatch [Wrm]? if so, i don’t believe it is a false alarm and you should ask your tech-guru for a cashback… anyway, send the file to the www.virustotal.com analysis and post the results here…
Personally I don’t think it is a certainty that it is a false positive, you only have to search the forums for user32.dll has been the target of an infection win32:syspatch {wrm} - you don’t say what the malware name was given ?
You could have saved $90 by coming here first and using this free resource.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.
Try running this tools as by all accounts it has been able to detect and repair this one - Dr. Web CureIT (On-Demand Only)